Overview

overview

10

Static

static

10

spr.exe

windows7-x64

10

spr.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    spr.exe
  • Size 276KB
  • Sample240119-2dnevsfcd9
  • SHA256 374e1cfd4204ff7833ca74d99952f6db74568966be4456c9c44342c8ee3dc53b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cybergate[email protected]persistencestealertrojanupx

Malware Config

Extracted

Family

  • cybergate

Version

  • 2.6

C2

  • purzel.zapto.org:12345

Mutex

  • ***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svhost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    nein spass aber dann kannste mal sehen wie schnell es geht ... beim nächsten mal bisschen schlauer sein und nicht an so ein scheiss glauben wie hack das gibts nicht ist alles fake oder sonstiges .......

  • message_box_title

    jetzt bist du gehackt ...

  • password

    nadine2

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target
      spr.exe
    • Size 276KB
    • SHA256 374e1cfd4204ff7833ca74d99952f6db74568966be4456c9c44342c8ee3dc53b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    cybergate[email protected]persistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks